bisecting fixing commit since 57fa2369ab17d67e6232f85b868652fbf4407206 building syzkaller on 805b5003de8c474f5d317a67f739597ebc78fcca testing commit 57fa2369ab17d67e6232f85b868652fbf4407206 with gcc (GCC) 10.2.1 20210217 kernel signature: 8475279f0a40bf53d5eade3ffc5d1b7d6419d57bac3ca7be7e46b016d534937c run #0: crashed: BUG: corrupted list in team_priority_option_set run #1: crashed: BUG: corrupted list in team_priority_option_set run #2: crashed: BUG: corrupted list in team_priority_option_set run #3: crashed: BUG: corrupted list in team_priority_option_set run #4: crashed: BUG: corrupted list in team_priority_option_set run #5: crashed: BUG: corrupted list in team_priority_option_set run #6: crashed: BUG: corrupted list in team_priority_option_set run #7: crashed: BUG: corrupted list in team_priority_option_set run #8: crashed: BUG: corrupted list in team_priority_option_set run #9: crashed: BUG: corrupted list in team_priority_option_set run #10: crashed: BUG: corrupted list in team_priority_option_set run #11: crashed: BUG: corrupted list in team_priority_option_set run #12: crashed: BUG: corrupted list in team_priority_option_set run #13: crashed: BUG: corrupted list in team_priority_option_set run #14: crashed: BUG: corrupted list in team_priority_option_set run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK testing current HEAD 007b350a58754a93ca9fe50c498cc27780171153 testing commit 007b350a58754a93ca9fe50c498cc27780171153 with gcc (GCC) 10.2.1 20210217 kernel signature: fab56a0764e664432255bd42f8956d1aaf3e6118534a7a7a45c6ede547349c4f run #0: crashed: BUG: corrupted list in team_priority_option_set run #1: crashed: BUG: corrupted list in team_priority_option_set run #2: crashed: BUG: corrupted list in team_priority_option_set run #3: crashed: BUG: corrupted list in team_priority_option_set run #4: crashed: BUG: sleeping function called from invalid context in lock_sock_nested run #5: crashed: BUG: corrupted list in team_priority_option_set run #6: crashed: BUG: corrupted list in team_priority_option_set run #7: crashed: BUG: corrupted list in team_priority_option_set run #8: crashed: BUG: corrupted list in team_priority_option_set run #9: OK revisions tested: 2, total time: 37m23.562311716s (build: 14m5.872124239s, test: 22m42.007320771s) the crash still happens on HEAD commit msg: Merge tag 'dlm-5.14' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm crash: BUG: corrupted list in team_priority_option_set list_del corruption, ffff88802d841480->prev is LIST_POISON2 (dead000000000122) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:48! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 31110 Comm: syz-executor272 Not tainted 5.13.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__list_del_entry_valid.cold+0x37/0x4a lib/list_debug.c:48 Code: f2 ff 0f 0b 4c 89 ea 48 89 ee 48 c7 c7 20 8d ff 88 e8 81 e2 f2 ff 0f 0b 4c 89 e2 48 89 ee 48 c7 c7 80 8d ff 88 e8 6d e2 f2 ff <0f> 0b 48 89 ee 48 c7 c7 40 8e ff 88 e8 5c e2 f2 ff 0f 0b 83 c3 01 RSP: 0018:ffffc9000b3b7440 EFLAGS: 00010286 RAX: 000000000000004e RBX: 0000000000000007 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffffff88ff8a80 RDI: fffff52001676e7b RBP: ffff88802d841480 R08: 000000000000004e R09: ffff8880b9f2ff07 R10: ffffed10173e5fe0 R11: 000000000000009e R12: dead000000000122 R13: ffff888031697c70 R14: 0000000000000025 R15: ffff88802d841488 FS: 00007f321ad72700(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f321ad71298 CR3: 0000000013315000 CR4: 0000000000350ee0 Call Trace: __list_del_entry include/linux/list.h:132 [inline] list_del_rcu include/linux/rculist.h:166 [inline] __team_queue_override_port_del drivers/net/team/team.c:819 [inline] team_queue_override_port_prio_changed drivers/net/team/team.c:876 [inline] team_priority_option_set+0x12e/0x2a0 drivers/net/team/team.c:1519 team_option_set drivers/net/team/team.c:374 [inline] team_nl_cmd_options_set+0x552/0xa60 drivers/net/team/team.c:2645 genl_family_rcv_msg_doit+0x1e4/0x2f0 net/netlink/genetlink.c:739 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] genl_rcv_msg+0x27a/0x4a0 net/netlink/genetlink.c:800 netlink_rcv_skb+0x118/0x370 net/netlink/af_netlink.c:2504 genl_rcv+0x1f/0x30 net/netlink/genetlink.c:811 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x42e/0x700 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x70e/0xbe0 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xab/0xe0 net/socket.c:674 ____sys_sendmsg+0x5bf/0x7a0 net/socket.c:2337 ___sys_sendmsg+0xd3/0x150 net/socket.c:2391 __sys_sendmsg+0xb2/0x140 net/socket.c:2420 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x44af99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 16 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f321ad72308 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004d6328 RCX: 000000000044af99 RDX: 0000000000000000 RSI: 0000000020000100 RDI: 000000000000000d RBP: 00000000004d6320 R08: 0000000000000040 R09: 0000000000000000 R10: 0000000000000044 R11: 0000000000000246 R12: 00000000004d632c R13: 000000000049f51c R14: 0030656c69662f2e R15: 0000000000022000 Modules linked in: ---[ end trace 68f9a3530cedad2a ]--- RIP: 0010:__list_del_entry_valid.cold+0x37/0x4a lib/list_debug.c:48 Code: f2 ff 0f 0b 4c 89 ea 48 89 ee 48 c7 c7 20 8d ff 88 e8 81 e2 f2 ff 0f 0b 4c 89 e2 48 89 ee 48 c7 c7 80 8d ff 88 e8 6d e2 f2 ff <0f> 0b 48 89 ee 48 c7 c7 40 8e ff 88 e8 5c e2 f2 ff 0f 0b 83 c3 01 RSP: 0018:ffffc9000b3b7440 EFLAGS: 00010286 RAX: 000000000000004e RBX: 0000000000000007 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffffff88ff8a80 RDI: fffff52001676e7b RBP: ffff88802d841480 R08: 000000000000004e R09: ffff8880b9f2ff07 R10: ffffed10173e5fe0 R11: 000000000000009e R12: dead000000000122 R13: ffff888031697c70 R14: 0000000000000025 R15: ffff88802d841488 FS: 00007f321ad72700(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f321ad0f718 CR3: 0000000013315000 CR4: 0000000000350ef0